follow up
luckily, my bank's customer service was open today (i wonder why they don't get the day off?). they seemed to think this was a completely random attempt at stealing money. some number generator happened upon my pin with my particular card. i guess it's to be expected, i've had the same card number for 5+ years and been using the same pin for longer.
i think i read somewhere that you should request a new card more often than the expiration date would lead you to believe, and change your pin even more often. i wonder what's worse, having post-its all over your desk with passwords and pins or just remembering them and hoping this doesn't happen to you?